netflow version 5 sampling

Unanswered Question
Nov 12th, 2008
User Badges:

I have created a sampler map and applied it on the interface and got the flows exported. However when I capture the flows in wireshark i cannot see the sampling information on the header.


My configuration is


cisco2811#sh flo

cisco2811#sh flow-sampler


Sampler : nfa, id : 1, packets matched : 2484, mode : random sampling mode

sampling interval is : 100

cisco2811#



cisco2811#sh run | incl flow

flow-sampler-map nfa

flow-sampler nfa

ip flow-export version 5

ip flow-export destination 192.168.112.152 9996

cisco2811#sh ip flow export

Flow export v5 is enabled for main cache

Exporting flows to 192.168.112.152 (9996)

Exporting using source IP address 192.168.118.32

Version 5 flow records

1800 flows exported in 197 udp datagrams

0 flows failed due to lack of export packet

1 export packets were sent up to process level

0 export packets were dropped due to no fib

0 export packets were dropped due to adjacency issues

0 export packets were dropped due to fragmentation failures

0 export packets were dropped due to encapsulation fixup failures



My version is:

Cisco IOS Software, 2800 Software (C2800NM-SPSERVICESK9-M), Version 12.4(3i), RELEASE SOFTWARE (fc2)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2007 by Cisco Systems, Inc.

Compiled Wed 28-Nov-07 21:09 by stshen


ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)



Is there any special commands required to populate the sampling interval in the v5 header?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
owillins Tue, 11/18/2008 - 09:37
User Badges:
  • Silver, 250 points or more

Make sure Modular Gigabit Ethernet doesn't support Netflow record.

Specifies a statistical sampling NetFlow export random sampling mode and a packet interval.

mode random one-out-of packet-interval

Example:

Router(config-sampler-map)# mode random one-out-of 100

The random keyword specifies that sampling uses the random sampling mode.

The one-out-of packet-interval argument-keyword pair specifies the packet interval (one out of every n packets) from which to sample. For n, you can specify from 1 to 65535 (packets).

For further information click this link.

http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/nflow_filt_samp_traff_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1056811


linker.team Wed, 11/19/2008 - 04:46
User Badges:

I have done that. I have created a flow sampler map through that command. However I am not able to see the sampler interval in the netflow V5 packet. In the doc it says you can see the sampling interval in the padding field of the netflow v5 packet.

Actions

This Discussion